When I started building my first Google Workspace Add-on - Form Prefiller - I thought the hardest part would be getting the code right.
Spoiler: it wasn't.
The real challenge was understanding Google's verification process - dozens of back-and-forth emails, unclear rejection notes, and hours spent tweaking OAuth scopes until everything finally lined up.
If you're building your first add-on, this post will save you weeks of confusion.
Here's exactly what the process looked like for me - what worked, what didn't, and what I wish someone had told me earlier.
Form Prefiller is a Google Forms™ add-on that helps automate form filling.
It lets users upload a spreadsheet (CSV/Excel/Google Sheets), map their columns to Google Form fields, and automatically generate personalized pre-filled links - all at once.
The idea came from watching schools, HR teams, and small businesses repeatedly fill the same forms with slightly different data.
It started simple - a tool for generating pre-filled links - but soon grew to include:
Once I was happy with the product, it was time to publish it on the Google Workspace Marketplace.
That's when the real learning began.
Google's review isn't a single step.
There are actually two independent approval processes, handled by two different teams:
| Step | Reviewer | What They Check |
|---|---|---|
| 1. OAuth Verification | Google Cloud OAuth Team | Data access, API scopes, privacy policy, security, external requests |
| 2. Marketplace App Review | Google Workspace Marketplace Team | Functionality, UI quality, listing copy, icons, and user experience |
You'll usually need both.
If your add-on uses any sensitive or restricted scopes (and most do), OAuth verification must be completed first.
I submitted my OAuth verification request, feeling confident.
Two days later, the reply landed in my inbox:
And that was just the beginning.
Over the next few weeks, I received nearly 20 emails from Google's verification team. Each one highlighted something small but critical - things I hadn't even realized mattered.
Here's what I learned the hard way 👇
If your script calls any API outside of Google - like a web app endpoint or OpenAI API - you must pin those URLs using the urlFetchWhitelist field in your appsscript.json.
Each Google API scope you request must have a clear justification.
Example of what worked for me:
https://www.googleapis.com/auth/forms.currentonlyYou'll need to do this for every scope - including Gmail (gmail.send or gmail.compose), Drive, and external requests.
This is where many developers stumble.
Your privacy policy must be clear, specific, and hosted on a public domain (not a Google Doc).
I hosted mine at:
👉 brightconstruct.co/form-prefiller#privacy-policy
Make sure it includes:
https://myaccount.google.com/permissionsAnd yes - the reviewer will actually click the link to check.
Because Form Prefiller uses OpenAI for Smart Mapping, I had to clarify that no user data or responses are sent - only form field names and spreadsheet headers.
That one line made the difference between a 403 rejection and approval.
It took me just over a month to get OAuth verification.
Each email from Google added more clarity - about HTTPS security, data flow, or endpoint pinning.
It was frustrating at times, but by the end, I understood my own system's privacy model far better than before.
Once OAuth verification was approved, I moved to the Marketplace App Review - and thankfully, this part was faster.
Here's what they checked:
The Marketplace team also installed my add-on, tested generating pre-filled links, and even checked the AI mapping pop-up.
Within a week - I got the green light. ✅
After approval, I released Smart Mapping - an AI-powered feature that automatically pairs form fields with spreadsheet columns.
Already helping early adopters pre-fill Google Forms faster - teachers, HR teams, and small businesses included.
The best part? Every scope, request, and dialog now fits within Google's verification framework cleanly. It's privacy-safe, transparent, and ready for scale.
If you're building your first Google Workspace Add-on, know this:
The review process isn't there to slow you down - it's there to make your product stronger and more trustworthy.
By the end of it, you'll have:
This is part of a series on building Google Workspace Add-ons. Up next:
Want to be notified when these go live? Email me at info.brightconstruct@gmail.com and I'll add you to the list.
Feel free to reach out - I'm happy to share more details about the verification process: